DEV Community: Fabián BCH.

Identification of cyber threats using Big Data architectures

Fabián BCH. — Wed, 18 Feb 2026 16:57:08 +0000

The massive use of Information and Communication Technologies has led to the interdependence of society with respect to them; added to the absence of efficient and effective controls at a general level, increases the exposure to cyberattacks or threats, to vulnerabilities in the information assets of organizations.

In this context, this article proposes a data analysis architecture using Big Data tools and security events or logs to improve event identification, integration, and correlation. The research methodology employed was exploratory and descriptive.

The proposed solution was developed using the Big Data processing phases proposed by Labrinidis and Jagadish, which enable the identification of cyber threats. The designed technological architecture was based on the integration of the Elastic Stack and its main components (Elasticsearch, Logstash, Kibana), and technologies such as Filebeat and Wazuh Security Detection (NIPS/HIDS), managing security across information assets such as communications equipment, data and application servers, database engines, and end-user terminals.

Its implementation would allow for real-time and historical monitoring of an agile and effective response to security alerts and status reports in the event of incidents.

Although some time has passed, I am sharing with you an abstract of my Master's Thesis (TFM) condensed into an academic paper, published in November 2021 along with professors from the Universidad Tecnológica ECOTEC, proposing a model for identifying threats by applying Big Data architectures.

INNOVA Research Journal, Universidad Internacional del Ecuador
November 2021, Published scientific article.

https://orcid.org/0000-0002-7994-3890

https://revistas.uide.edu.ec/index.php/innova/article/view/1860

https://www.researchgate.net/publication/356545358_Identificacion_de_amenazas_informaticas_aplicando_arquitecturas_de_Big_Data

https://www.gworks-ec.com

Vulnerability management strategy

Fabián BCH. — Thu, 12 Feb 2026 18:56:54 +0000

Vulnerability management and its respective mitigation are critical aspects in the security of companies, since they allow mitigating the risks to which assets are exposed. To learn about the importance and possible approaches to improve enterprise security posture (SPM), some key criteria are outlined.

- Regulatory and/or regulatory compliance:

Organizations, by their nature, must comply with security regulations and vulnerability management, in this sense it is important to comply with regulations or standards such as GDPR (EU), HIPAA, SOX or ISO 27001:2023 and its Annex A, among others.

- Recurring security assessments:

It is advisable to execute continuous security assessments and tests, such as penetration tests, adversary emulation and vulnerability scans, allowing the identification of security gaps in the organization.

- Assets protection:

Vulnerability management helps safeguard confidential data, as well as the organization's critical assets, allowing us to mitigate possible risks such as loss, theft or exfiltration of information.

- Prioritization and categorization of vulnerabilities:

As part of vulnerability management, it is necessary to categorize, classify and prioritize security breaches according to their criticality and impact on the organization, allowing security teams to focus their efforts on resolving critical and high-level findings, mainly , but without losing sight of the medium and low level.

- Implementation of security patches:

Keep technological infrastructure platforms (hardware and software) updated with the latest security patches recommended by different manufacturers, to mitigate at least known vulnerabilities.

- Prevention and identification of cyber threats:

Identifying vulnerabilities early and proactively reduces the possibility of exploitation of gaps by attackers or adversaries (pentesters).

[Boost]

Fabián BCH. — Mon, 14 Apr 2025 18:58:49 +0000

Willie Reyes

Nov 21 '24

Entendiendo los Identificadores ARN y AIDA en AWS IAM

#aws #cloudcomputing #cloudsecurity

Comments

2 min read